except that facebook can make ad for malware independently of flaw in facebook code